S0464 SYSCON

malwareEnterprise

platformsWindows

also known asSYSCON

SYSCON is a backdoor that has been in use since at least 2017 and has been associated with campaigns involving North Korean themes. SYSCON has been delivered by the CARROTBALL and CARROTBAT droppers.

techniques used (5)

ATT&CK techniques this enables or maps to.

T1057Process Discovery
T1059.003Windows Command Shell
T1071.002File Transfer Protocols
T1082System Information Discovery
T1204.002Malicious File

used by campaigns (1)

Campaigns that use this.

C0006Operation Honeybee

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan